AD CS CVE-2026-69624

The attacker must hold a valid, low-privilege Active Directory account (PR:L confirmed by CVSS vector) with network access to an AD CS enrollment endpoint - no elevated permissions, no special role, and no user interaction required. The AD CS role must be installed and operational on a Windows Server within the affected build ranges. Exploitation is limited to environments running the AD CS role service; Windows Server installations not running AD CS are unaffected. There is no non-default configuration required to be vulnerable: any standard AD CS deployment on an unpatched build is susceptible to any domain-authenticated principal.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N places this at a base score of 6.5, reflecting a network-reachable, low-complexity attack requiring only a low-privilege domain account - no user interaction or elevated rights needed. The integrity-only impact (I:H, C:N, A:N) may appear moderate in isolation, but in the context of AD CS, integrity compromise can cascade into certificate-based authentication attacks such as shadow credentials or PKINIT abuse, elevating the effective risk well beyond the numerical score suggests. No EPSS data was provided in source inputs, and this CVE is not listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis. That said, even a mid-sized municipal IT team in ustka should treat this as urgent given how broadly Windows Server AD CS is deployed and how frequently PKI misconfigurations are leveraged in post-exploitation. The patch is available across all affected server versions, and the attack complexity being low means any domain-joined account holder could potentially trigger the condition, making rapid patching the clear priority.

An attacker with a low-privilege domain account sends a crafted certificate enrollment request to an AD CS endpoint, supplying an input value absent from the service's deny list. The incomplete validation permits the malicious input to pass, allowing the attacker to tamper with certificate attributes, enrollment policy, or issuance state, potentially issuing certificates with unintended subject alternative names or key usages. No public exploit code has been identified, but the low complexity and common precondition of any domain account make this readily reproducible from the description alone.